CVE Vulnerability Catalog

An authorization bypass vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Manipulation of the sid/addtime/type/reason/detail/logdate arguments in user/editLog.php leads to authorization bypass. The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability in Lemonldap::NG::Handler (Perl) allows bypassing locationRules by using an equivalent spelling of a path. The handler matches regular expressions against the raw REQUEST_URI, while the web server routes on the percent-decoded and normalized path, allowing bypass of deny rules, identity and group conditions, and unprotect and skip rules. Only vhosts whose default rule is more permissive than other rules are affected.

Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific configuration conditions. Individuals with read access to system logs or support bundles can retrieve these credentials.

A vulnerability in containerd (open-source container runtime) prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1. A crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability.

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager with access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Folder.

Apache Airflow HashiCorp provider contains a bypass of the team-scope guard in the HashiCorp Vault secrets backend. A Dag author scoped to one team can supply a Variable key containing a path separator, causing the backend to resolve a secret belonging to a different team. The vulnerability affects multi-team deployments and is reachable from ordinary Dag code.

A vulnerability in chillzhuang SpringBlade up to 5.0.2 affects the UserServiceImpl.userInfo function in the user-auth-info Endpoint component. Manipulation of the userId argument causes authorization bypass, allowing remote attack.

A vulnerability in jhen0409 react-native-debugger up to 0.14.0 affects the openDevTools function in electron/window.js. Manipulation of the host argument results in OS command injection, allowing remote attack.

LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts this value and narrows it to int without performing range validation. This out-of-range conversion triggers undefined behavior, resulting in process termination and denial of service.

libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This results in undefined behavior leading to denial of service.

The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticated attacker with adjacent network access could submit crafted command data that corrupts memory, potentially disrupting authentication state or causing the device to restart.

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device information, including device identifiers, firmware information, and protected WiFi credentials.

The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the support process. These logs remain accessible on removable storage after the support operation has completed. An unauthenticated attacker with physical access to the storage media could retrieve the logs and obtain sensitive device information.

The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with access to the device's WiFi network could submit a crafted request to access files within the device's removable storage that were not intended to be directly accessible through the web server. Exposed files could include recordings, images, diagnostic logs, or firmware files.

The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communications on the device's WiFi network could obtain stored recordings, live video, location information, images, diagnostic logs, or other sensitive information exchanged between the device and its mobile application.

The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. An attacker who obtains the firmware or has physical access to the device could recover the credential and use it to obtain root access through the UART interface.

The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who obtains the protected credential and extracts the cryptographic material from the firmware could recover the WiFi password and gain unauthorized access to the device network.

An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and archive protection keys are logged without proper masking. A local or authenticated user with access to application logs or support bundles can view these cleartext credentials, potentially leading to unauthorized access to remote backup targets or protected archives.

A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential identity mismatch conditions.

A vulnerability was found in the littrs library versions 0.6.1 and 0.6.2 in the Sandbox::mount function of crates/littrs/src/lib.rs. Manipulation of the relative argument leads to path traversal. The exploit has been publicly disclosed and the vendor did not respond.